Create workflow to trigger email if any specific business role(empty role) from list is assigned or revoked from user

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

Hi Experts,

We have requirement to create a new workflow to send an email if a specific business role(its an empty role i.e no actual provisioning/deprovisioning) is assigned or revoked to an identity.

Am struggling to start with trigger that I need to choose.

Any suggestions would be great :slight_smile:

Regards,

Bhushan Dhodi

2

Here is what I would do:

  1. Create an Identity Attribute: say “workflowTrigger”
  2. Use attached Transform to set the value for this attribute
  3. Workflow to trigger when the value of this attribute changes

Test_GetAssignedRoles.json (744 Bytes)

Now you can assign/revoke the specific role (“GetAssignedRulesTest” in my example) and the identity attribute will change in next calculation.

Note that workflow will not be triggered immediately when role is assigned/revoked

3

@bhushan008 you can follow this if it works for you

  1. Start from the access-item lifecycle event trigger that fires when access is assigned or revoked.
  2. Fetch the identity from the trigger so the workflow can include stable identity details in the email body.
  3. Validate the event represents a role, not an entitlement or access profile.
  4. Because the current requirement says “any role”, do not add a target-role ID filter. If you later narrow this to one role, add a role-ID choice step here.
  5. Branch on operation:
    • assignment path sends an “assigned” email
    • revoke path sends a “revoked” email
  6. Use the tenant’s native workflow email action to send the email to owner
  7. Keep the recipient and template structure the same across both paths, changing only the subject/body language for assign vs revoke.
  8. End successfully after either email path. Non-role events should exit as no-op success.
  9. Route workflow email failures to a single failure step.
4

Hi @bhushan008 ,

One approach you could try is using a metadata-driven solution. For all the empty/business roles that require an email notification, add a role metadata attribute such as genericEmailRequired: Yes.

Then, depending on your requirement:

  • Use the Provisioning Completed workflow trigger if you want the email to be sent only after the role assignment/removal has been successfully processed.
  • Or use the Access Request Submitted trigger if you want the notification to be sent immediately after the request is submitted.

Within the trigger payload, you can identify the processed role(s). Then use an HTTP Request action to retrieve the role details via the SailPoint Roles API and read the value of the genericEmailRequired metadata attribute. If the value is Yes, send the email; otherwise, simply exit the workflow without sending anything.

This approach keeps the workflow generic and avoids hardcoding role names. You only need to maintain the metadata on the roles that require email notifications.